e3dc70be0bec3733776fe34306d4e40f_JaffaCakes118
- SHA256 150fa94ea2e5a0d01197b7404c8716b87a23154271342d5def957fa2b5192594
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PRICE_REQUEST_00989_PDF.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
PRICE_REQUEST_00989_PDF.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target e3dc70be0bec3733776fe34306d4e40f_JaffaCakes118
- Size 336KB
- Sample240407-c2me2aag71
- SHA256 150fa94ea2e5a0d01197b7404c8716b87a23154271342d5def957fa2b5192594
- MD5 e3dc70be0bec3733776fe34306d4e40f
- SHA1 caca6c4d007ba29b031fcf063c2abca8ec60c9f8
- SHA512 cb095a2e19e49a1616249006ea3e7dcf0ba5cd212eb732e22e144cb65a3d046db03dfcab07d834eb210b3fcaeaf8efef81c3f46c7e6384b75ee2c72a496eff10
- SSDEEP 6144:N3LMr+11eJ5hKvdppe3QYz7w0OVjBRCrtU15hIh2yN9ovfL+DeRvVkz:N3QrK1eJevDpeA+7janCBa13hw
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/PRICE_REQUEST_00989_PDF.exe
File Explorer
-
e3dc70be0bec3733776fe34306d4e40f_JaffaCakes118.eml 336KB
-
PRICE_REQUEST_00989_PDF.rar.rar 245KB
-
PRICE_REQUEST_00989_PDF.exe.exe 294KB
-
email-plain-1.txt20B
PRICE_REQUEST_00989_PDF.rar
- SHA256 5ffccbedb9e2fa838e020c5d2cca6c099b50825d3ab689c1317fbf03f072c94c
- MD5 d7135d64b09727ca09c5bbfb872b926d
- SHA1 3ae4387279bf8c3949a39d07a916f693942123c0
- SHA512 caeef3badb1011d0e476e7a08c364dab8ca09a9bb8dcfd9727d2fce525b981a1f87b4e1bb586b4aa6c1cf4715c45e0654ed3cc1c2bf168428fb75bcdd5d2bf0c
- SSDEEP 6144:I87aQjF2uLI2qigV9pZ4lJtOUhsnVgUGWhyM2ns:I81F2gqxpZ4fkUhMVgPpMd
- MD5 SHA1 SHA512 SSDEEP
PRICE_REQUEST_00989_PDF.exe
- IMPHASH 47132e7294d9df76f8ee6d6805dd5e2d
- SHA256 c063613033c4be101d74aefe076f82f6183e35689137fc36a929cc5c40ea043d
- MD5 d7c537f5105f35574c6ba6ed27a367a4
- SHA1 ec227719a6b17990eb50a33c0206c997c6ea24f3
- SHA512 ebdc8353ae2bd120298eaed2399521e34f43f18524ea3e50c8bd143bc678a78bb14f7941c4346c7f40577f8e1c2fe566667ee390d0494c95f284f4cbd2bd6767
- SSDEEP 6144:nFvSNWJdLFv687N1CTXOsaphq9WkDExvls7MMKp0j/JvzLh/:nBSNev687noXOZ3q9WkDeNs7/BZ/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\xampp\htdocs\Cryptor\2e2215ca131e4a7b82e3366a41e0634c\Loader\pr1\Release\pr1.pdb
kernel32
DecodePointer
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
LCMapStringW
GetConsoleOutputCP
VirtualProtect
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
RaiseException
user32
LoadIconW
LoadCursorW
EndPaint
BeginPaint
GetDC
UpdateWindow
GrayStringA
TranslateAcceleratorW
LoadAcceleratorsW
EndDialog
DialogBoxParamW
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
LoadStringW
gdi32
CreateSolidBrush
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=27412,
count=139, id=261, version=27412,
count=18, id=260, version=27412,
count=16, id=259, version=24123,
count=29, id=261, version=24123,
count=17, id=260, version=24123,
count=7, id=257, version=27412,
count=103, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
email-plain-1.txt
- SHA256 71c7f48a0caf9260e4a576ad5d6620d179bf01318abb906c665fd87dc7af80ad
- MD5 6e5f7d7ea68fd46497921af1eb9f0086
- SHA1 68654b6f5bcd7baf541a9dd173d2f54853a9c877
- SHA512 b014d078774826633f3e263917da99dff944dbabf2eceb8ecafebcd543f6e3a2e037084fefc88d3c7ef0d1771d4faf3f70a03ef6f00583b013f22c1bd8082ede
- MD5 SHA1 SHA512